DOCSEARCHbyAlgolia
Submit Docs

Trail of Bits Skills Marketplace

repository·main·Indexed 27 days ago

https://github.com/trailofbits/skills

A collection of Claude Code plugins for AI-assisted security analysis, testing, and development. Includes specialized tools for smart contract security (Algorand, Cairo, Cosmos, Solana, Substrate, TON), GitHub Actions workflow auditing via agentic-actions-auditor, codebase comprehension with audit-context-building, Burp Suite project parsing, and development assistants for secure contract building.

Tokens
334.4K
Snippets
771
Records
1.5K
Agent score
92%

What's inside trailofbits-skills

  1. Overview of Constant-Time Analysis Skill

    main

    The Constant-Time Analysis Skill is a Claude Code skill designed to detect timing side-channel vulnerabilities in cryptographic code. It works by analyzing assembly or bytecode output to identify dangerous instructions that leak secrets through execution timing.

    Key Capabilities:

    • Vulnerability Detection: Identifies variable-time instructions like division or floating-point operations.
    • Multi-Architecture Support: Analyzes compiled output for x86_64, ARM64, RISC-V, and more.
    • Scripting Language Support: Analyzes PHP, JavaScript/TypeScript, Python, and Ruby via bytecode.
    • Remediation Guidance: Provides patterns for constant-time fixes such as Barrett reduction and constant-time selection.
    • CI Integration: Produces JSON output for automated pipelines.

  2. Overview of Property-Based Testing Skill

    main

    The Property-Based Testing (PBT) skill is a Claude Code skill designed to assist with property-based testing across various programming languages and smart contract development.

    It provides capabilities for:

    • Detecting PBT opportunities: Identifying patterns like encode/decode pairs, validators, normalizers, pure functions, and smart contract invariants.
    • Generating tests: Creating tests with appropriate strategies, properties, and edge cases.
    • Reviewing tests: Identifying issues such as tautological properties, vacuous tests, and weak assertions.
    • Property-Driven Development: Designing specifications before implementation.
    • Refactoring: Suggesting code changes to improve testability.

  3. Overview of Static Analysis skills

    main

    The Static Analysis plugin provides a toolkit for security vulnerability detection. It includes three primary skills:

    • codeql: Performs deep security analysis using interprocedural taint tracking and data flow analysis.
    • semgrep: Provides fast, pattern-based security scanning.
    • sarif-parsing: Parses and processes SARIF (Static Analysis Results Interchange Format) output from various security scanners to aggregate and deduplicate findings.

  4. Overview of zeroize-audit Claude Skill

    main

    The zeroize-audit skill is designed to detect missing zeroization of sensitive data (keys, passwords, secrets) in C, C++, and Rust source code. It identifies cases where zeroization is removed or weakened by compiler optimizations (like dead-store elimination) using assembly-level and IR analysis.

    Key Capabilities:

    • Assembly-level analysis for register spills and stack retention.
    • Data-flow tracking for secret copies.
    • Control-flow graph (CFG) analysis for path coverage.
    • Semantic LLVM IR analysis.
    • Runtime validation test generation.
    • Generation of Proof-of-Concept (PoC) exploits for findings.

  5. Overview of the gh-cli plugin

    main

    The gh-cli plugin intercepts GitHub URL fetches and redirects Claude to use the authenticated gh CLI instead of WebFetch or standard Bash commands like curl and wget.

    Key Benefits

    • Private Repository Access: Enables fetching of private repos that would otherwise return 404 errors.
    • Higher Rate Limits: Uses authenticated requests (up to 5,000/hour) instead of unauthenticated ones (60/hour).
    • Complete Data: Ensures full API responses by using your existing GitHub authentication.

    Interception Patterns

    ToolPatternSuggested Action
    WebFetchgithub.com/{owner}/{repo}gh repo view owner/repo
    WebFetchgithub.com/.../blob/...gh repo clone + Read
    WebFetchgithub.com/.../tree/...gh repo clone + Read/Glob/Grep
    WebFetchapi.github.com/repos/.../pullsgh pr list / gh pr view
    WebFetchapi.github.com/repos/.../issuesgh issue list / gh issue view
    WebFetchapi.github.com/...gh api <endpoint>
    WebFetchraw.githubusercontent.com/...gh repo clone + Read
    Bashcurl https://api.github.com/...gh api <endpoint>
    Bashcurl https://raw.githubusercontent.com/...gh repo clone + Read
    Bashwget https://github.com/...gh release download
    Bash (shim)gh api repos/.../contents/...gh repo clone + Read
    Bash (shim)gh repo clone ... /tmp/... (non-session-scoped)Use session-scoped clone path

    What is NOT intercepted

    • Non-GitHub domains.
    • GitHub Pages (*.github.io).
    • Commands already using gh (unless they match the anti-patterns above).
    • Standard Git commands (git clone, git push, etc.).
    • Search commands mentioning GitHub URLs (grep, rg, etc.).

  6. Use the Windows Process & Token bug cluster

    main

    The cluster-windows-process is a specialized bug-hunting cluster designed for Windows-only environments. It targets four specific bug classes related to process creation, cross-process handles, privilege tokens, and service security.

    Bug Class ID Prefixes:

    • CREATEPROC: CreateProcess misuse (e.g., unquoted paths, handle leaks).
    • CROSSPROC: Cross-process memory or handle issues (e.g., PROCESS_ALL_ACCESS to untrusted PIDs).
    • TOKPRIV: Token or privilege misuse (e.g., improper AdjustTokenPrivileges usage).
    • WINSVC: Service security issues (e.g., weak service DACLs, unquoted ImagePath).

    Gate Requirement: This cluster requires the is_windows gate to be met.

  7. Understand the Audit Context Building workflow phases

    main

    The skill operates through three distinct phases to build system understanding:

    1. Initial Orientation: Mapping modules, entrypoints, actors, and storage.
    2. Ultra-Granular Function Analysis: Performing line-by-line semantic analysis with cross-function flow tracking.
    3. Global System Understanding: State/invariant reconstruction, workflow mapping, and trust boundary identification.

  8. Understand the Zeroize Audit Report format

    main

    The Zeroize Audit Report is a structured document generated by the zeroize-audit tool to identify security vulnerabilities related to sensitive data retention (e.g., secrets left on the stack, in registers, or in heap memory).

    Key sections include:

    • Executive Summary: High-level metrics on files scanned, total findings, and counts categorized by severity, confidence, and category.
    • Sensitive Objects Inventory: A list of identified sensitive objects (e.g., keys, nonces) including their type, location, and whether they have a verified wipe.
    • Findings: Detailed vulnerability reports categorized by severity (High, Medium, Needs Review). Each finding includes:
      • Location: File path and line number.
      • Object: The specific variable or memory region involved.
      • Evidence: Technical proof from source code, assembly ([asm]), Intermediate Representation ([ir]), or compiler analysis.
      • Recommended Fix: Actionable steps to remediate the vulnerability (e.g., using explicit_bzero()).
    • PoC Validation Results: Results from automated Proof-of-Concept generation and testing to confirm exploitability.
    • Confidence Gate Summary: Explanations for why certain findings were downgraded (e.g., due to unavailable MCP signals).
    • Analysis Coverage: A breakdown of which analysis agents (MCP resolver, source analyzer, compiler analyzer, etc.) succeeded or failed during the run.

  9. Use the Semgrep Rule Creator skill

    main

    The semgrep-rule-creator skill is used to create production-quality Semgrep rules for detecting security vulnerabilities, bug patterns, or enforcing coding standards. It supports both simple pattern matching and advanced taint mode for data flow analysis.

    Ideal scenarios:

    • Writing rules for specific bug patterns or security vulnerabilities.
    • Writing taint mode rules for data flow vulnerabilities (e.g., user input reaching a dangerous sink).
    • Enforcing coding standards.

    When NOT to use:

    • Do not use this skill to run existing Semgrep rulesets; use the static-analysis skill instead.

  10. Use the Devcontainer Setup Skill

    main

    The devcontainer-setup skill creates a pre-configured development environment containing Claude Code, language-specific tooling (Python, Node, Rust, or Go), and persistent volumes. Use this skill when you need to add devcontainer support to a project, set up an isolated development environment, or configure a sandboxed workspace for Claude Code.

    When NOT to use:

    • If you already have a devcontainer configuration and only need minor modifications.
    • For general Docker or container questions.
    • For production container deployment (this is for development only).

  11. Use Seatbelt Sandboxer for MacOS process isolation

    main

    Seatbelt Sandboxer is used to generate MacOS Seatbelt configurations that sandbox a target process with the minimum necessary permissions.

    Use Cases

    • Isolating processes on MacOS without using containers.
    • Sandboxing trusted applications that execute untrusted third-party code (e.g., Javascript bundlers).
    • Reducing the blast radius of applications at high risk of supply chain attacks.

    Important Limitation

    Do NOT use this skill to run an untrusted process. The skill requires running the target process to profile it and determine required permissions. Running an untrusted process during profiling defeats the purpose of the sandbox.

  12. Use the Cosmos Vulnerability Scanner

    main

    The Cosmos Vulnerability Scanner is designed to scan Cosmos SDK modules and CosmWasm contracts for vulnerabilities that cause chain halts, consensus failures, or fund loss. It uses parallel scanning agents to identify patterns related to non-determinism, state divergence, and cross-module interactions.

    Output directory: Defaults to .bughunt_cosmos/. You can specify a different directory in your prompt.

    When to Use

    • Auditing custom Cosmos SDK x/ modules.
    • Reviewing CosmWasm smart contracts.
    • Pre-launch security assessments of Cosmos chains.
    • Investigating chain halt incidents.

    When NOT to Use

    • Pure Solidity/EVM audits without Cosmos SDK (use Solidity-specific tools).
    • CometBFT consensus engine internals (this covers SDK modules, not the consensus layer).
    • General Go code review without blockchain context.
    • Cosmos SDK application logic that is not consensus-critical (e.g., CLI commands, REST endpoints).
    • CosmWasm contract-only audits on chains without custom SDK modules (use the CosmWasm checklist alone).